Jacob Strieb writes about programming, Zig, and small web tools like Urlpages and Link Lock, plus essays on how language models work.
Commenters share his Link Lock as an open source, client-side option and agree with his point that AI output sounds correct.
It's very bad, because cookies, permissions and lots of other presisted data will be shared by all scripts on the domain.
Example:
Alice makes a benign page that uses location data and shares the link with her friends. The friends know what's up and grant location permissions to get the page to work.
What they actually did, however was grant location permissions to "https://jstrieb.github.io/urlpages" and any script served by that origin.
So when some of the friends later open Eve's URL that contains a location harvester, they don't get any prompt at all: Eve's link can just reuse the location permission given to Alice because, as far as the browser is concerned, both scripts belong to the same page.
The point from the end of the post that AI produces output that sounds correct is exactly what I try to emphasize to friends and family when explaining appropriate uses of LLMs. AI is great at tasks where sounding correct is the essence of the task (for example "change the style of this text"). Not so great when details matter and sounding correct isn't enough, which is what the author here seems to have rediscovered.
The most effective analogy I have found is comparing LLMs to theater and film actors. Everyone understands that, and the analogy offers actual predictive power. I elaborated on the idea if you're curious to read more:
https://jstrieb.github.io/posts/llm-thespians/
I meant all the pages published using this tool which are all at the same scope of: https://jstrieb.github.io/urlpages/#blahblah
That said I couldn't get it to work. You would need to be able to register a service worker file at something like https://jstrieb.github.io/urlpages/sw.js but all the pages you have control over have proper html mime type and are rejected when you try to register them (and have too much actual html junk in them to run as js files anyway).
Love it!
Have you thought about having a non-obfuscated pretty version?
In addition to this:
https://jstrieb.github.io/urlpages/editor/#eyJjc3MiOiJ3aG9tIiwianMiOiJkb2N1bWVudC53cml0ZShcInRoaXMgd2FzIHdycml0ZW4gYnkgamF2YXNjcmlwdFwiKSIsImh0bWwiOiJiYW0ifQ==
Offer a pretty version like:
https://jstrieb.github.io/urlpages/editor/#html...html-here.~css...body;background:red;~javascript...document.write('this-was-written-by-javascript.')
Someone shared this piece here a few days ago saying something similar. There’s no reason to believe that any of the experiences are real. Instead they are responding to prompts with what their training data says is reasonable in this context which is sci-fi horror.
Edit: That doesn’t mean this isn’t a cool art installation though. It’s a pretty neat idea.
https://jstrieb.github.io/posts/llm-thespians/
Nice, I used different tools before and sharing it here if anyone is interested.
- Static sites password (1)
- Link lock, to lock the url (2)
(1) https://github.com/matteobrusa/Password-protection-for-static-pages
(2) https://jstrieb.github.io/link-lock/create/